diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index bb2a270..decdf41 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -35,11 +35,24 @@ jobs:
           pnpm build
 
       - name: rust gate
+        # --locked: a build that would change Cargo.lock fails rather than
+        # quietly resolving something new (#49).
         run: |
           set -euo pipefail
           cargo fmt --check --all
-          cargo clippy --workspace --all-targets -- -D warnings
-          cargo test --workspace
+          cargo clippy --locked --workspace --all-targets -- -D warnings
+          cargo test --locked --workspace
+
+      - name: dependency policy
+        # deny.toml: licenses, advisories, bans and sources; machete: crates
+        # declared and never used. Both ship in the runner image (gongfoo
+        # runner-rust). The daily run in deps.yaml catches an advisory
+        # published against an unchanged lockfile (#49).
+        run: |
+          set -euo pipefail
+          cargo deny --version
+          cargo deny check
+          cargo machete
 
       - name: rust talks to the webview through one file
         # `ui/src/api/wallet.ts` is the only module allowed to import Tauri's
diff --git a/.gitea/workflows/deps.yaml b/.gitea/workflows/deps.yaml
new file mode 100644
index 0000000..393536f
--- /dev/null
+++ b/.gitea/workflows/deps.yaml
@@ -0,0 +1,25 @@
+name: deps
+
+# The advisory half of the dependency policy on a clock (#49). CI runs the
+# full policy on every push; this runs the advisory check daily, so a
+# RustSec advisory published against a dependency this repository already
+# pins turns red within a day even when nobody pushes.
+
+on:
+  schedule:
+    - cron: "17 5 * * *"
+  workflow_dispatch:
+
+jobs:
+  advisories:
+    # `rust`: cargo-deny ships in the image; no GTK is needed to read a
+    # lockfile against the advisory database.
+    runs-on: rust
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: advisories against the pinned lockfile
+        run: |
+          set -euo pipefail
+          cargo deny --version
+          cargo deny check advisories